ci: add the per-package release-candidate and release workflows

[nahimterrazas]

The hardhat-tron rc/release pair, adapted for the two-workspace monorepo. Closes the publish-flow half of #13.

Differences from the single-package source, each deliberate

• Per-package everything: rc.yml takes the workspace as a dispatch input; release tags are <workspace>-v<version> (tronbox-upgrades-v0.1.0, hardhat-tron-upgrades-v0.1.0), and release.yml resolves the workspace from the tag and cross-checks it against the tarball's own name and version.
• rc.yml does not re-run the suites: the packed commit is on main, which branch protection only admits through the full CI matrix (unit suites + both live packed-tarball consumer e2es). What rc validates is the artifact.
• The audit gates on the tarball's production tree, not the root lockfile: the monorepo root lock mixes every workspace's development tree. Both rc and release resolve the tarball's own tree lock-only in a scratch consumer (no dependency script executes — release holds id-token: write) and run npm audit --omit=dev --audit-level=high on that.
• Registry-verify window 40×30s (today's low-priority follow-up): npm took ~15 min to serve hardhat-tron's first publish and the run ended red on success.

What the flow needs besides this PR

The publish environment already exists here (reviewers + prevent self-review). Missing only the temporary granular NPM_TOKEN secret, and the environment's deployment rules must admit the per-package tags (tronbox-upgrades-v*, hardhat-tron-upgrades-v*).